Connecting a Kaisin workspace

Approving the grant, what it can and cannot do, and the two things you line up afterwards.

Three steps, in this order. Each refuses until the one before it is done.

1. Connect the workspace

From Integrations → Kaisin, press Connect Kaisin. You are asked for one thing: the https address you sign in to your Kaisin at. orcakey.sh checks that the address is a reachable Kaisin before your browser leaves.

You are sent to that Kaisin’s own consent page, signing in there first if you have not. Only a Kaisin Admin or Owner can approve; anyone else reaches the page and finds no Approve button.

What the grant can do

The consent page states this in plain words, and it is exactly what the grant is good for, nothing more:

List projects, applications and their environments.
Read and write the variables it manages.

That is all. It is not your session and cannot sign in as you. It cannot read a variable you set yourself, and it cannot touch anything outside those two things. A write it makes restarts or rebuilds the application it wrote to — see what it is — and that is the only consequence approving it has.

The grant does not expire on its own. It lasts until it is revoked, from either side.

The consent page also shows the address orcakey.sh will return to, so you can check it before approving. The hosted orcakey.sh, api.orcakey.sh, is shipped as verified. Any other address still works, but the page marks it “Unverified app — this is not orcakey.sh” beside the address. If you run a self-hosted orcakey.sh, its operator adds its address to Kaisin’s Kaisin:VerifiedIntegrationOrigins setting to clear that warning.

Either way

Approving returns you to the Kaisin page in orcakey.sh, which now shows the workspace by the name Kaisin reports, with a green dot and who connected it, just now. Declining or closing the consent page returns you with a sentence saying nothing was connected; neither side holds anything.

Only one Kaisin workspace connects per organisation. Connecting the same one again renews the grant; a different Kaisin is refused until you disconnect the first.

2. Align a project

On a project’s Kaisin card, or from Integrations → Kaisin, pick a Kaisin project and then an application in it, both from lists Kaisin returns, by the names Kaisin shows.

3. Connect an environment

Per orcakey environment, press Connect an environment, pick one of that application’s Kaisin environments — a persistent one, never a single PR preview — and pick the collection(s) that feed it. A key in no collection feeding the connection goes nowhere.

The row reads <project> / <environment> → <application> · <environment> · N keys · waiting, then live once the first push has landed.

Disconnecting

Disconnecting from orcakey.sh asks first when connections depend on the workspace, naming how many; confirming removes them and revokes the grant in Kaisin. If Kaisin cannot be reached, orcakey.sh still forgets the grant and tells you to revoke it yourself under Settings → Connected apps in Kaisin.

Revoking from Kaisin’s side (Settings → Connected apps) works the same way in reverse: the next push fails, and the row says Kaisin revoked orcakey.sh’s access.